Summary
According to a BleepingComputer report, a malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on October 29. The source says the extension could expose up to 5,000 developers to malware designed to install persistent SSH backdoors. The report describes the extension as a fake or tampered version of a legitimate tool, distributed through a third-party marketplace rather than Anthropic's own channels.
AI-assisted summary based on the listed source.
What happened
A malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors. [...]
Why it matters
Developers who installed extensions from Cursor's marketplace during that window could have systems with persistent SSH access installed by attackers. Teams should check whether the malicious extension was installed, review SSH keys and access logs, and remove the affected version. Watch for follow-up details from the vendors on how the extension got into the marketplace and how marketplace vetting will change.
Signal Intelligence
Signal Strength 95%
Technical label SOURCE-BACKED
Public Interest 51
Category AI AT WORK
Reader Depth TECHNICAL
Event context 1 source
Signal Strength reflects source quality, relevance, freshness and evidence. Public Interest helps organize discovery; it is not proof of truth.
Public Interest components
Recognizable Entity Score 82
Practical Impact Score 28
Novelty Interest Score 70
Consequence Score 30
Curiosity Score 0
Shareability Score 64
Why this is here
VQV surfaced this signal because it is recent, relevant to AI Coding Tools, connected to BleepingComputer.
